From cb955e81bb21071e176f7c36c68a26f269c47909 Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Mon, 27 Jul 2026 14:35:19 +0100 Subject: [PATCH 1/2] fix: bound basic constraints path length Co-authored-by: OpenCode --- src/CertManager.sol | 4 +++- test/CertManager.t.sol | 12 ++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/CertManager.sol b/src/CertManager.sol index 29ecfd0..ae89ccf 100644 --- a/src/CertManager.sol +++ b/src/CertManager.sol @@ -551,7 +551,9 @@ contract CertManager is ICertManager { if (certificate[basicConstraintsPtr.header()] == 0x02) { if (basicConstraintsPtr.length() == 0) revert InvalidBasicConstraints(); - maxPathLen = int64(uint64(certificate.uintAt(basicConstraintsPtr))); + uint256 pathLen = certificate.uintAt(basicConstraintsPtr); + if (pathLen > 0x7fffffffffffffff) revert InvalidBasicConstraints(); + maxPathLen = int64(uint64(pathLen)); } else { revert InvalidBasicConstraints(); } diff --git a/test/CertManager.t.sol b/test/CertManager.t.sol index 6db1293..48c9d71 100644 --- a/test/CertManager.t.sol +++ b/test/CertManager.t.sol @@ -99,6 +99,18 @@ contract CertManagerTest is Test { assertEq(int256(certManagerHarness.verifyBasicConstraints(hex"30060101ff020100", true)), 0); } + function test_BasicConstraintsAcceptsMaxInt64PathLen() public view { + assertEq( + int256(certManagerHarness.verifyBasicConstraints(hex"300d0101ff02087fffffffffffffff", true)), + int256(type(int64).max) + ); + } + + function test_BasicConstraintsRejectsPathLenAboveInt64Max() public { + vm.expectRevert(CertManager.InvalidBasicConstraints.selector); + certManagerHarness.verifyBasicConstraints(hex"300e0101ff0209008000000000000000", true); + } + function test_BasicConstraintsRejectsEmptyPathLen() public { vm.expectRevert(CertManager.InvalidBasicConstraints.selector); certManagerHarness.verifyBasicConstraints(hex"30050101ff0200", true); From c20f6f2cec63a70e7ede429d54299d5e34bfc4c8 Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Wed, 29 Jul 2026 11:53:48 +0100 Subject: [PATCH 2/2] style: clarify path length bound Co-authored-by: OpenCode --- src/CertManager.sol | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/CertManager.sol b/src/CertManager.sol index ae89ccf..60fc3aa 100644 --- a/src/CertManager.sol +++ b/src/CertManager.sol @@ -552,7 +552,7 @@ contract CertManager is ICertManager { if (certificate[basicConstraintsPtr.header()] == 0x02) { if (basicConstraintsPtr.length() == 0) revert InvalidBasicConstraints(); uint256 pathLen = certificate.uintAt(basicConstraintsPtr); - if (pathLen > 0x7fffffffffffffff) revert InvalidBasicConstraints(); + if (pathLen > uint256(uint64(type(int64).max))) revert InvalidBasicConstraints(); maxPathLen = int64(uint64(pathLen)); } else { revert InvalidBasicConstraints();